An out‑of‑bounds write in Adobe’s DNG SDK allows a malicious file to corrupt memory when it is opened. The corruption can cause the application to crash or become unresponsive, resulting in a denial‑of‑service condition for that process and possibly the entire system. The weakness is a classic buffer overrun, classified as CWE‑787.

Adobe DNG SDK versions 1.7.1 2502 and earlier are affected. Any installation that includes these builds and processes DNG files is subject to potential exploitation.

The CVSS severity rating of 5.5 indicates a medium level of risk, but the lack of a publicly available EPSS score makes it unclear how often this flaw is actively targeted. The flaw is not listed in CISA’s KEV catalog, suggesting no widespread active exploitation. Because a victim must open a malicious file, the attack vector is local or requires user interaction, which limits the scope but still represents a real threat to users who accept unknown media.